writeups.xyz / Insufficient Redirect URI validation: The risk of allowing to dynamically add arbitrary query parameters and fragments to the redirect_uri

Submitter : c2a

Date: 6 November 2021

Bounty : undisclosed

Vulnerabilities :

• OAuth
• Prototype Pollution

Programs :

• GitHub
• Microsoft
• StackExchange

Authors :

• Lauritz Holtmann (@_Lauritz_)

Link :
https://security.lauritz-holtmann.de/post/sso-security-redirect-uri-ii/